CVE-2026-89451

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

iommu/sva: Set handle->dev before the SVA handle is visible

iommu_attach_device_pasid() installs the new SVA attach handle in the

group PASID lookup before iommu_sva_bind_device() returns. A concurrent

bind can therefore find and reuse the same handle after iommu_sva_lock is

dropped.

handle->dev was initialized after dropping iommu_sva_lock. This leaves a

window where a racing bind can return a handle whose dev pointer is still

NULL. A subsequent iommu_sva_unbind_device() can then dereference it via

handle->dev->iommu_group.

Initialize handle->dev before releasing iommu_sva_lock so any visible SVA

handle is fully initialized.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References